topic Re: asa 5510 version 9.1 (7) 16 cannot delete static route in Network Security

asa 5510 version 9.1 (7) 16 cannot delete static route

WannaB — Fri, 21 Feb 2020 14:16:01 GMT

Hello, need help in deleting static route to outside interface. New to ASA, I picked up a asa firewall for a home lab and it is behind a ARRIS NVG599. I have set my outside interface to obtain an IP Address from DCHP on network 192.168.1.0. I have my Inside interface configured to support 10.1.1.0 network but cannot ping from a machine connected to the inside interface to a machine on the outside interface. My thought process was to create a static route to 192.168.1.254 but that did not work. So now I'm thinking to set a static route to the IP Address that the outside interface has which is 192.168.1.111 but I cannot delete the current static route which is 0 0 192.168.1.254. So how can I delete the current static route?

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

Flavio Miranda — Sat, 02 Sep 2017 20:32:39 GMT

Try this:

clear configure route

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

WannaB — Sat, 02 Sep 2017 22:32:46 GMT

Thank you, that seems to have worked. Thank you so much

Another question any Ideas of how to NAT behind an ARRIS

NVG599. I tried using the example below but it did not work. Also, I cannot ping from the 10. network to a 192. network.

The following example configures dynamic NAT that hides 192.168.2.0 network behind a range of outside addresses 10.2.2.1 through 10.2.2.10:
hostname(config)# object network my-range-obj
hostname(config-network-object)# range 10.2.2.1 10.2.2.10
hostname(config)# object network my-inside-net
hostname(config-network-object)# subnet 192.168.2.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) dynamic my-range-obj

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

WannaB — Sat, 02 Sep 2017 22:33:51 GMT

Thank you, that seems to have worked. Thank you so much

Another question any Ideas of how to NAT behind an ARRIS
NVG599. I tried using the example below but it did not work. Also, I cannot ping from the 10. network to a 192. network.

The following example configures dynamic NAT that hides 192.168.2.0 network behind a range of outside addresses 10.2.2.1 through 10.2.2.10:
hostname(config)# object network my-range-obj
hostname(config-network-object)# range 10.2.2.1 10.2.2.10
hostname(config)# object network my-inside-net
hostname(config-network-object)# subnet 192.168.2.0 255.255.255.0
hostname(config-network-object)# nat (inside,outside) dynamic my-range-obj

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

Flavio Miranda — Sat, 02 Sep 2017 23:57:30 GMT

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

Flavio Miranda — Sat, 02 Sep 2017 23:59:38 GMT

Don't follow.

What about Arris? Can you put a draw? Or explain better your environment?

Sure we can help.

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

Marvin Rhoads — Mon, 04 Sep 2017 03:10:42 GMT

Ping is not generally a good test as is it not inspected by default when passing through an ASA. You need to add 'inspect icmp' to the default class-map for the ASA to keep track of the ping (icmp echo request) packets and allow the echo replies.

Generally I try to test using a tcp-based connection like ssh, telnet or http.

Re: asa 5510 version 9.1 (7) 16 cannot delete static route

WannaB — Sun, 17 Sep 2017 20:10:16 GMT

Sorry for the very late response. I have attached a .pdf file explaining what I'm trying to do.